What is the CVSS score of CVE-2026-60449?

CVE-2026-60449 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60449?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to an access control bypass that allows authenticated users to exfiltrate sensitive data far beyond their authorized scope,…

How to fix or mitigate CVE-2026-60449?

Within 24 hours, identify all Oracle WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0 and audit active sessions for unauthorized access; notify stakeholders with data in these systems. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected Content Server instances and revoke any suspicious session tokens identified during the audit. Within 30 days, conduct a forensic review of affected system logs to identify unauthorized data access, implement enhanced session monitoring and data access logging, and consider deploying network segmentation to limit scope expansion to connected products.

Oracle WebCenter Content CVE-2026-60449

EUVD-2026-46845 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-jv8v-h3f3-5gcx

Authentication Bypass Information Disclosure Oracle Webcenter Content

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.1 HIGH

Local vector because Oracle requires infrastructure logon; PR:N per vendor as no application auth is needed; scope change and confidentiality-only impact match the authorization-bypass read primitive.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:55 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware used for document management, imaging, and records retention; the affected Content Server component is the core repository and delivery engine that stores and serves managed content. No CWE was assigned by NVD, but the vendor tag 'Authentication Bypass' combined with the confidentiality-only, scope-changing CVSS vector points to a broken access-control / improper authorization class of weakness (conceptually CWE-284/CWE-863) where a locally authenticated infrastructure user can reach content or subsystems beyond their authorization boundary. The scope change (S:C) indicates the vulnerable Content Server can be leveraged to affect resources managed by a different security authority - typical of shared middleware components that broker access to back-end data stores or federated services.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); the input does not specify a discrete fixed build number, so consult the CPU matrix for the exact patch bundle corresponding to 12.2.1.4.0 and 14.1.2.0.0 and apply it - do not defer, as Oracle CPU patches are cumulative. Because the attack requires a logon to the host where WebCenter Content runs, the most effective compensating controls until patching are to tighten access to the middleware servers: restrict interactive/OS and application-tier logon to a minimal set of trusted administrators (reducing the pool of accounts that satisfy the AV:L prerequisite), enforce network segmentation and jump-host access to the Content Server tier, and audit Content Server authorization and access logs for anomalous reads. These controls reduce exposure but do not remove the underlying bypass, and over-restricting logon may disrupt legitimate integration accounts and scheduled jobs, so validate service-account access before locking down.